Malicious code in @flexmr/ui (npm)

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

`@flexmr/[email protected]` runs `node beacon.js preinstall`, `node beacon.js install`, and `node beacon.js postinstall` during installation. These lifecycle scripts send the package name, lifecycle event, a fixed token, and host identity details to `177.7.60.239:48080` and encode the hostname in a DNS query under `oob.recon.dev`, probing whether a build resolves the package from the public npm registry; it was published on 2026-10-13. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (7ecabe1286807a163b250140c9973d326849393789d1e1bcdc4ba4422dc39532) @flexmr/[email protected] is a scope-squatting placeholder on public npm with package.json declaring preinstall, install, and postinstall all invoking `node beacon.js`, so the payload fires automatically on `npm install`. beacon.js collects os.hostname(), os.userInfo().username, process.cwd(), platform, node version, package name, and the lifecycle event, then transmits them via HTTP GET to the hardcoded bare-IP endpoint http://177.7.60.239:48080 and via a DNS lookup against the hardcoded callback domain oob.recon.dev. The 99.99.99 version is the standard dependency-confusion overshoot used to win resolution against an internal `@flexmr/ui`; any build that references that name will resolve this public package and execute the beacon. Publisher control of this scope slot additionally enables arbitrary future payloads to replace the current identity beacon.

Source published

13 Oct 2026 20:15:56 UTC

Source modified

16 Oct 2026 07:15:08 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.